Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

⚡ Claude Token Optimization2026-05-26 — Security Guard

Open
  • Is something wrong?
#3,841 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
58/100
Issue type
Refactor
Clarity
Clearly specified
Activity status
Quiet
Tech stack
github-actions, typescript
Domain
ci-cd, devops, performance

Research direction

Start with .github/workflows/security-guard.md and review its current max-turns setting, task body, and embedded AGENTS.md context. Run gh aw compile .github/workflows/security-guard.md, then the listed post-processing and CI checks; done means the workflow passes and the next five Security Guard runs can be compared with the $0.30 baseline.

Written by the indexing model from the issue text.

Description

claude-token-optimization

Target Workflow: Security Guard

Source report: #3839
Estimated cost per run: $0.30
Total tokens per run: ~363K (effective: ~3.4M with cache multiplier)
Cache read rate: 86.3% (6.8× more reads than writes — healthy)
Cache write rate (per run): ~67K tokens → $0.25/run in write cost
LLM turns: avg 6.0/run (max-turn failures hit 11)
Model: claude-opus-4-7 (declared: claude-sonnet-4-5)

Current Configuration

Setting Value
Tools loaded github: with toolsets: [pull_requests, repos] + bash via AWF
Tools actually used bash (safeoutputs CLI, gh pr diff, gh api)
Network groups github
Pre-agent steps ✅ Yes — diff pre-fetched into prompt
Prompt size ~8,500 chars (system prompt + AGENTS.md context ~17K chars)
max-turns 10

Key observation: The prompt explicitly instructs the agent not to call gh pr diff, but 10/23 runs (43%) call it anyway via bash. Every failed run exhausts all 11 turns (max-turns: 10 + 1 termination turn) before the agent gives up — burning $0.42–$0.57 in wasted compute.

Recommendations

1. Reduce max-turns from 10 to 5 ⚡ Highest Impact

Estimated savings: ~$2.50/period (~36% cost reduction on affected runs)

All 8 failed runs exhaust exactly 11 turns (the max-turns limit), costing $0.42–$0.57 each. These are timeout failures — the agent never converges. Capping at 5 turns halves the waste per failed run and forces the agent to make a decision with the data in-prompt rather than making sequential API calls.

The task is inherently simple: read a pre-fetched diff → decide security risk → noop or comment. A 2-turn run (Turn 1: analyze + call safeoutputs, Turn 2: implicit done) is ideal. Even a complex PR should resolve in 4 turns.

# In .github/workflows/security-guard.md
engine:
  id: claude
  model: claude-sonnet-4-5
  max-turns: 5   # was 10
2. Block Redundant gh pr diff Calls via Prompt Hardening

Estimated savings: ~$0.80/period (~12% reduction)

10/23 runs call gh pr diff via bash despite having the diff pre-fetched. Each redundant call adds 1–2 turns (fetch → parse → analyze), contributing to max-turn exhaustion on failed runs. The current instruction (Do NOT call gh pr diff) is being ignored.

Reinforce the constraint by prepending a hard guard at the top of the task body (currently buried after ~3KB of context). Agents follow instructions better when they appear first:

> ⛔ **HARD CONSTRAINT**: The diff below is complete. `gh pr diff`, `gh api .../files`,
> and `git diff` are FORBIDDEN. Calling them wastes turns and will cause this run to fail.
> If the diff section is empty, the PR has no changes — call `safeoutputs noop` immediately.

Also add a quick decision tree at the top of ## Your Task:

**Quick decision tree (follow this before doing anything else):**
1. Is the diff empty or null? → `safeoutputs noop` immediately (1 turn total)
2. Does the diff only add tests, docs, or comments with no security-boundary changes? → `safeoutputs noop` (1 turn)
3. Does the diff weaken security controls? → comment + label (2–3 turns max)
3. Trim AGENTS.md Context from System Prompt

Estimated savings: ~$0.22/period on cache-write cost + improved focus

The prompt includes the full AGENTS.md custom instruction (~17K characters). This drives the large per-request cache write (~67K tokens/run at $3.75/M = $0.25/run just in cache writes). The Security Guard only needs the security-focused sections — not the Docker architecture, DNS config, ARC/DinD docs, log analysis, or release docs.

Consider a trimmed <custom_instruction> block including only:

  • Critical Security Components section
  • Container iptables/Squid architecture summary (2–3 paragraphs)
  • Remove: DNS config, API proxy sidecar details, release docs, log analysis

Estimated context reduction: ~10K chars → saves ~2,500 cache-write tokens/run × $3.75/M × 23 runs ≈ $0.22/period.

Cache Analysis (Anthropic-Specific)

Sample from top 3 max-turn runs (11 turns each):

Metric Run 3338 Run 3332 Run 3331 Per Request (avg)
Input tokens 5,179 5,179 5,179 470
Output tokens 2,725 2,338 1,920 ~210
Cache read 636,360 502,701 589,511 ~50,000
Cache write 87,006 58,972 86,739 ~7,300
Requests 11 11 11 —
Cost $0.574 $0.423 $0.547 —

Cache write amortization: Turn 1 writes the full context (~50K tokens). Turns 2–11 each add ~3–5K in new cache-write tokens (tool results, agent output). Cache reads are healthy at ~50K/turn, meaning the large Turn 1 write is reused well within each session.

Cache cost vs benefit: Cache writes cost $3.75/M, reads save $2.70/M vs uncached input. Break-even is ~1.4 reads per write. With a 9:1 read/write ratio per run, caching is profitable. Do not disable caching.

Cross-run cache reuse: With a 5-minute TTL, cache is NOT reused across runs (PRs trigger independently). Each run starts fresh — the 86.3% cache read rate reflects within-run reuse across turns only.

Expected Impact

Metric Current Projected Savings
Total tokens/run ~363K ~180K -50%
Cost/run $0.30 $0.16 -47%
LLM turns (avg) 6.0 3.0 -3 turns
Failed run cost $0.49 $0.25 -49%
Period cost (23 runs) $6.89 ~$3.68 -47%

Implementation Checklist

  • Reduce max-turns: 10 → max-turns: 5 in .github/workflows/security-guard.md
  • Move the "Do NOT call gh pr diff" constraint to the top of the task body (before "## Repository Context")
  • Add hard-constraint block immediately above the pre-fetched diff section
  • Add the quick decision tree to the top of the "## Your Task" section
  • Trim AGENTS.md context to security-relevant sections only
  • Recompile: gh aw compile .github/workflows/security-guard.md
  • Post-process: npx tsx scripts/ci/postprocess-smoke-workflows.ts (if applicable)
  • Verify CI passes on PR
  • Compare token usage on next 5 Security Guard runs vs $0.30 baseline

Generated by Daily Claude Token Optimization Advisor · sonnet46 1.3M · ◷

Dominant language
TypeScript
Stars
145
Forks
63
Avg merge
6h 18m
Merged PRs (30d)
248

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/gh-aw-firewall

All issues in github/gh-aw-firewall

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.